VIRY.CZRADAR
sektor
téma
typ textu
zrušit filtry

CVE-2025-23167 A flaw in Node.js 20's HTTP parser allows improper termination of HTTP/1 headers using `\r\n\rX` instead of the required `\r\n\r\n`. This inconsistency enables request smuggling, allowing attackers to bypass proxy-based access controls and submit unauthorized requests. The issue was resolved by upgrading `llhttp` to version 9, which enforces correct header termination. Impact: * This vulnerability affects only Node.js 20.x users prior to the `llhttp` v9 upgrade.

2 karet z 2 položek · v celém archivu · celý přehled CZ · EN/orig

CVE-2025-23167

EPSS 0.01 EPSS k 26. 10. 2026

Hodnocení závažnosti

6.5 CVSS 3.0 hackerone

útok odkudkoli z internetu bez přípravy bez přihlášení bez zásahu uživatele
dopad únik části dat dílčí změna dat bez výpadku
přesah dopad jen na zranitelnou součást

CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N

zvyšuje závažnost mírně zvyšuje závažnost snižuje závažnost

cve.org · NVD

· zachyceno

Multiples vulnérabilités dans Tenable Enclave Security (28 août 2026)

De multiples vulnérabilités ont été découvertes dans Tenable Enclave Security. Elles permettent à un attaquant de provoquer un problème de sécurité non spécifié par l'éditeur.

EPSS 0.87 a dalších 4 CVE-2024-22017 CVE-2024-22019 CVE-2024-27980 CVE-2024-27983 CVE-2024-36138 CVE-2025-23166 CVE-2025-23167 CVE-2025-27210 CVE-2025-55130 CVE-2025-55131 CVE-2025-55132 CVE-2025-59465 CVE-2025-59466 CVE-2026-21637 CVE-2026-27140 CVE-2026-27143 CVE-2026-39822 Tenable FR

tg: zranitelnost

· zachyceno · CERT-FR – avis · Multiples vulnérabilités dans Tenable Enclave Security (28 août 2026)

CVE-2025-23167 A flaw in Node.js 20's HTTP parser allows improper termination of HTTP/1 headers using `\r\n\rX` instead of the required `\r\n\r\n`. This inconsistency enables request smuggling, allowing attackers to bypass proxy-based access controls and submit unauthorized requests. The issue was resolved by upgrading `llhttp` to version 9, which enforces correct header termination. Impact: * This vulnerability affects only Node.js 20.x users prior to the `llhttp` v9 upgrade.

Information published.

EPSS 0.01 CVE-2025-23167 Node.js US

· Microsoft Security · CVE-2025-23167 A flaw in Node.js 20's HTTP parser allows improper termination of HTTP/1 headers using `\r\n\rX` instead of the required `\r\n\r\n`. This inconsistency enables request smuggling, allowing attackers to bypass proxy-based access controls and submit unauthorized requests. The issue was resolved by upgrading `llhttp` to version 9, which enforces correct header termination. Impact: * This vulnerability affects only Node.js 20.x users prior to the `llhttp` v9 upgrade.